What is TCP checksum offload and why is TCP checksum offload in Wireshark?

Article Source: http://hi.baidu.com/zyqq/blog/item/54bb905256546f040cf3e3a9.html

 

In fact, this problem is often found during packet capture. Today I went to Google with curiosity.

In a simple summary, the packet captured by Wireshark prompts a checksum error,It is only because it intercepts the overhead checksum of the operating system, and the Gigabit NIC will hand over the computing work to the NIC after enabling checksum offload, the NIC finally calculates the correct checksum and sends it out.

Original article: Non-octopus

In the past few days, when analyzing the communication packets, we found that Wireshark showed some bad checksum packets sent by the local machine, and prompted maybe caused by "TCP checksum offload ?"

Google, and foundThis is a function of the network card. It can replace the system's TCP/IP protocol stack to calculate the TCP packet checksum.

In Windows, the checksum offload process is as follows:

If the network adapter supports this function, you can set the checksum offload option in advanced options to check whether it is valid for RX or Tx, or both.

For Tx, after setting the checksum offload to be valid, the transfer layer of Windows will randomly fill in the TCP Checksum, so the packet captured on the local machine is bad checksum. Then, the network adapter automatically calculates the correct verification code and sends it. Therefore, the other party still receives the correct TCP packet.

For RX, when the checksum offload is set to be effective, the NIC will fill in an ndis_tcp_ip_checksum_packet_info structure and set the flag. If the flag fails for some reason, no flag is set, data verification is completed by the TCP/IP protocol stack in windows.

Checksum offload is actually a part of the work of the transport layer handed over to the hardware to save the system's CPU resources. Microsoft tests show that it can save up to 30% of CPU resources.Ibm aix documentationIt is pointed out that for the Gigabit Nic of PCI interface, it is better to let the CPU above MHz calculate the checksum, And the Gigabit Nic of PCI-X can achieve the line speed after enabling this, thus saving CPU resources.